Skip to main content

GLOBAL RANSOMWARE INTELLIGENCE

Information checked 2026.10.25 · Founded and operated by AL-TOUCH SOLUTIONS LIMITED

RANSOMWARE HUB · Checked 2026.10.26

Ransomware: From Major Incidents to AI Threats

Start with far-reaching incidents, then explore their origins, tactics and defences. Each case includes original sources and practical next steps drawn from known facts.

MAJOR INCIDENTS

Start with the Most Significant Events

Start with cross-border destruction and disruption to healthcare and critical services, then explore supply chain propagation. This is an editorial reading order; losses, affected populations and downtime cannot be directly compared across cases.

Reading order

NotPetya was a destructive attack disguised as ransomware. Data theft, encryption and downtime are distinct impacts, explained separately below with reference to the sources.

NotPetya

Destructive Attack Disguised as Ransomware Affects Logistics, Pharmaceuticals and Healthcare

US Department of Justice charges published in 2020 state that losses for the three victims identified in the document totalled nearly US$1 billion. The UK government said the attack's main purpose was destruction.

What Happened and Security Lessons

Technique overview: A compromised MeDoc tax software update provided the entry point, after which the malware spread through networks.
Security Lessons: Vendor updates can also be compromised. Limit permissions between systems and lateral spread, and practise independent recovery.

Original sourcesUK government ↗US Department of Justice ↗NCA / NCSC report ↗The nearly US$1 billion figure is the combined loss of three victims in the charging documents, not total global losses.

WannaCry

Self-spreading ransomware causes widespread disruption to UK healthcare services

The UK National Audit Office confirmed that at least 81 of England's 236 NHS trusts were affected. There were 6,912 recorded appointment cancellations, while the NHS estimated a total exceeding 19,000.

What Happened and Security Lessons

Technique overview: The self-propagating attack affected unpatched or unsupported Windows systems, disrupting normal computer services across multiple healthcare organisations.
Security Lessons: Pair patch notices with asset inventories and completion checks, and prepare contingency processes for disruption to clinical services.

Original sourcesUK National Audit Office investigation ↗The organisation and appointment figures above are limited to NHS England. More than 19,000 is an estimate, not a global figure.

Change Healthcare

A shared service provider outage disrupts pharmacy claims and healthcare payments

UnitedHealth's chief executive testified to the US Senate that attackers gained entry on 12 February and deployed ransomware nine days later, disrupting pharmacy claims, medical claims and payment services.

What Happened and Security Lessons

Technique overview: Stolen credentials were used to log into a Citrix portal without multi-factor authentication, followed by lateral movement and data exfiltration.
Security Lessons: Apply multi-factor authentication at every remote entry point, and maintain workable alternatives in case a shared service provider is affected.

Original sourcesSenate testimony — 2024-05-01 ↗Based on the company's contemporary Senate testimony; assistance loans, ransom payments and subsequent losses are treated separately.

Colonial Pipeline

Ransomware Incident Shuts Down a Fuel Pipeline

The company proactively halted pipeline operations because of the attack. The US Department of Energy records that the entire pipeline system had restarted by 13 May and had begun delivering products to all markets.

What Happened and Security Lessons

Technique overview: The FBI confirmed that the incident involved DarkSide ransomware; an IT incident went on to affect physical operations.
Security Lessons: Inventory dependencies between information systems and physical operations, and rehearse safe shutdown, alternative supply and restart procedures.

Original sourcesUS Department of Energy Incident Record ↗Restarting the pipeline did not mean every retail petrol station returned to normal immediately that day.

Costa Rica Ministry of Finance

Revenue and Customs Systems Disrupted, with Lasting Effects on Public Services

The finance ministry's official audit confirms a ransomware attack on 18 April. A later audit identifies 18 April to 24 June as the period from system disruption to the announced restoration of the TICA customs system.

What Happened and Security Lessons

Technique overview: Ransomware affected revenue-related systems and TICA, forcing departments to use contingency processes. These audits did not fully reconstruct the initial intrusion path.
Security Lessons: Critical public services need auditable contingency handling, data back-entry and recovery verification processes.

Original sourcesMinistry of Finance 2022 audit ↗Ministry of Finance 2023 audit ↗This describes finance and customs systems; it does not combine figures from a separate healthcare-system attack.

Kaseya VSA

Abuse of a Management Platform Affects Many Downstream Businesses

In its 5 July update, Kaseya said fewer than 60 customers were directly affected, all using self-managed VSA, with fewer than 1,500 downstream businesses affected.

What Happened and Security Lessons

Technique overview: Attackers exploited a zero-day vulnerability to bypass authentication, then abused normal administration features to deploy ransomware to endpoints. At the time, the company had found no evidence of malicious changes to VSA code.
Security Lessons: Separate and narrow remote administration permissions, retaining the ability to disable access, isolate systems and contact downstream customers quickly.

Original sourcesKaseya technical analysis ↗Official Kaseya release notes ↗The figures are the supplier's estimates as of 5 July 2021. At that time, it had found no evidence of compromise among SaaS customers.

NEED HELP

Suspect a ransomware attack?

Read the initial response guide, or email us with details and your contact information. The scope and arrangements for support are confirmed case by case.

Email support enquiries ↗Read the initial response guide ↗Do not send passwords, verification codes or suspicious attachments